Find every security hole, before and after launch.
No surprise server bill after an attack. No users getting your paid plan for free. No data leak that turns into a lawsuit. Faundr checks your project every session, and your AI fixes what it finds.
One security hole, and you pay for it. In server bills, lost sales or leaked data.
Your server bill explodes.
A bot hammers your API, or someone finds your OpenAI key and runs up charges on it. You find out when the bill arrives.
Faundr checks
- Routes without rate limiting
- No request size limit
- Exposed AI key
- API abuse (AI review)
Users get your paid plan for free.
Access unlocks on the thank-you page, the price comes from the browser, or the webhook never verifies its signature. All it takes is knowing the URL.
Faundr checks
- Access granted on redirect
- Price sent from the browser
- Unverified Stripe webhook
- Webhook that double-charges
A data leak becomes a lawsuit.
One table without RLS exposes every customer’s name, email and ID number to anyone who visits. Under privacy laws like GDPR, CCPA and LGPD, that can mean fines and lawsuits.
Faundr checks
- Tables without RLS
- Database probed as a visitor
- service_role key in the browser
- Open Firebase rules
0
security checks. Backed by the full public database of package vulnerabilities.
- 0Keys and secrets
- 0AI review
- 0Code patterns
- 0Configuration
- 0Database test
- 0Database rules
All of the OWASP Top 10. The industry-standard list of web app vulnerabilities.
- A01Access controlRLS, live database test, IDOR, least privilege
- A02Crypto and secretsexposed keys, homemade crypto, unencrypted sensitive data
- A03InjectionSQL, command, eval, XSS
- A04Insecure designpayments and business logic
- A05Misconfigurationheaders, CORS, rate limits, Firebase
- A06Vulnerable dependenciesdaily OSV scans, malicious packages
- A07Authenticationunverified JWTs, MFA, 12 auth checks
- A08Integrityunsigned webhooks, hallucinated packages
- A09Logging and monitoringno audit trail, editable logs, no abuse alerts
- A10SSRFserver requests to user-supplied URLs
AI-built apps make the same security mistakes. Nobody notices until an outsider does.
AI agents know security well. But they only look when you ask, forget everything between sessions and stop watching once you ship. That’s where Faundr comes in.
Four layers. From the moment code is written to long after it ships.
Most of it runs locally, with no AI and zero tokens. The AI review runs on your own AI plan, only when you ask.
Instantly
Stops threats at the door.
Dangerous keys in code, packages that don’t exist and commands that would wipe your production database. A migration that can’t be undone gets a heads-up first.
Every session
Checks as you build.
A full scan when the session starts, then changed files after every reply.
Every day
Keeps watch while your laptop’s off.
Our servers check your packages against the public vulnerability database.
On demand
AI review and live database test.
Your AI reads every route the way an attacker would, a second reviewer tries to knock down each suspicion, and Faundr probes your database from the outside.
No security expertise required. The dashboard explains each issue, and your AI fixes it.
Every finding explains what’s wrong, what could happen and how to fix it. Copy the command in one click, your AI makes the fix, and the finding stays on the list until the check passes again.
Security: Stripe secret key hardcoded.
From code to database. Every finding comes with a severity, an explanation and a fix.
Keys and secrets
421 rulesKeys hardcoded in your code, secrets in variables that ship to the browser, and .env files committed to git. Every finding links straight to where you rotate the key.
- Stripe key hardcoded in sourceCritical
- Secret in a NEXT_PUBLIC_ or VITE_ variableCritical
- .env committed to gitCritical
- .env missing from .gitignoreHigh
Code checks in 17 languages and frameworks
- JavaScript & TypeScript
- React Native
- Vue
- Angular
- Svelte & Astro
- Python
- Flutter & Dart
- PHP
- Go
- Java
- Kotlin
- C#
- Rust
- C
- C++
- Docker
- HTML
- C, C++ · Packages: partial (only with Conan (conan.lock); vcpkg has no public database of known vulnerabilities)
- Docker · Packages: not yet (base images have no public database of known vulnerabilities (OSV); Quality flags images without a pinned version)
Nothing extra to install. Your language’s own tools are used only if your project already has them. See what each part covers, language by language
Reading the code isn’t enough. Faundr tests your database the way an outsider would.
Using your app’s public key, it tries to read, write, update and delete every table, as a visitor and as a brand-new user. Everything it does gets rolled back at the end.
| table | Read | Write | Update | Delete |
|---|---|---|---|---|
| orders | open | closed | closed | closed |
| profiles | closed | closed | closed | closed |
| coupons | open | open | closed | closed |
Nothing changes in your database.Every attempt is rolled back, touches one row at most and times out after 5 seconds.
Shows what would leak.Warns when a visitor can see emails, ID numbers, phone numbers or passwords.
Counts toward the launch verdict.An open database blocks "Ready for real users".
Your code never leaves your machine. Neither do your keys.
On your machine
new Stripe('sk_live_51HxQ2fK8…aB9Qz')
In the Faundr dashboard
src/checkout/pay.ts:2
sk_live_51Hx…9Qz
Checks run locally.Only the finding reaches the dashboard, with the key masked.
OSV only sees package names.Just the name and version of each package.
Your tokens stay with you.The Supabase token used for the database test never reaches Faundr.
Already use a security skill? Keep it. Faundr connects to it and shows every issue it finds.
A security audit from another plugin, or one your team wrote, reports to the same list as Faundr’s own checks. Its findings get a severity, a fix and a “via /skill-name” tag, so you always know where each one came from.
- /security-audit Plugin Connected · Security
Auditing routes, logins or database rules
- /write-copy Project
Writing or improving page copy
- S-14Orders route returns other users’ ordersvia /security-audit · src/api/orders.ts:18High
- S-13Stripe key hardcoded in sourceKey or password · src/checkout/pay.ts:2Critical
- S-12Password reset link never expiresvia /security-audit · src/auth/reset.ts:41Medium
- S-11No rate limit on any routeConfiguration · src/server.tsHigh
- Counted like Faundr’s own. Each issue becomes S-n in Security, with a severity and a fix, and weighs on the launch verdict the same way.
- Closes when it’s gone. Run the skill again and whatever it no longer finds closes. Each skill only closes its own findings, never Faundr’s or another skill’s.
- One command to connect. Faundr reads the skills from your repo, your personal folder and your plugins, and marks the ones that find problems. You can change that in the dashboard.
- Your skills stay on your machine. Only each skill’s name, description and where it came from reach Faundr.
FAQ
Does it replace a pentest?
No. Faundr reads your code, checks your packages and database rules, and tests the database with your public key, but it never attacks your live app. It catches the common mistakes before they ship. If your app handles highly sensitive data, a pentest is still worth it.
Does it work with my project?
Most likely. Code checks run in 17 languages and frameworks: JavaScript and TypeScript (React, Next.js, Vue, Angular, Svelte, Astro, React Native), Python, Go, Rust, Java, Kotlin, C#, PHP, Flutter, C, C++, Dockerfiles and HTML. Package checks read lockfiles from npm, Python, Rust, Go, PHP, Flutter, Ruby, .NET, Maven, Gradle and Conan. Databases: Supabase or Firebase. There’s nothing extra to install, and the docs show what’s covered in each language.
Does it use my tokens?
Scans, instant blocking and the database test all run without AI. Only the AI review (/faundr:security) and fixes use your own AI plan, and only when you ask.
I already use a security skill. Can I keep it?
Yes. Run /faundr:skills once and Faundr connects it. From then on, whatever it finds shows up here as S-n, tagged “via /its-name,” and closes when a rerun no longer finds it. Only the skill’s name, description and where it came from reach Faundr.
What about false positives?
Ignore it for 7, 30 or 90 days with a reason: not an issue, or accepted risk. Keys in example files and dev-only packages already get a lower severity.